Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-49384
Publication date:
15/10/2024
Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.
Severity CVSS v4.0: Pending analysis
Last modification:
04/02/2025

CVE-2024-45275
Publication date:
15/10/2024
The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices.
Severity CVSS v4.0: Pending analysis
Last modification:
17/10/2024

CVE-2024-45274
Publication date:
15/10/2024
An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.
Severity CVSS v4.0: Pending analysis
Last modification:
17/10/2024

CVE-2024-45276
Publication date:
15/10/2024
An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication.
Severity CVSS v4.0: Pending analysis
Last modification:
24/01/2025

CVE-2024-45273
Publication date:
15/10/2024
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.
Severity CVSS v4.0: Pending analysis
Last modification:
17/10/2024

CVE-2024-45272
Publication date:
15/10/2024
An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost.
Severity CVSS v4.0: Pending analysis
Last modification:
17/10/2024

CVE-2024-45271
Publication date:
15/10/2024
An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation.
Severity CVSS v4.0: Pending analysis
Last modification:
21/10/2024

CVE-2024-9973
Publication date:
15/10/2024
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=reports of the component Report Viewing Page. The manipulation of the argument date leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: MEDIUM
Last modification:
15/10/2024

CVE-2024-9974
Publication date:
15/10/2024
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php?f=add_to_card of the component POST Request Handler. The manipulation of the argument product_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: MEDIUM
Last modification:
15/10/2024

CVE-2024-47945
Publication date:
15/10/2024
The devices are vulnerable to session hijacking due to insufficient <br /> entropy in its session ID generation algorithm. The session IDs are <br /> predictable, with only 32,768 possible values per user, which allows <br /> attackers to pre-generate valid session IDs, leading to unauthorized <br /> access to user sessions. This is not only due to the use of an <br /> (insecure) rand() function call but also because of missing <br /> initialization via srand(). As a result only the PIDs are effectively <br /> used as seed.
Severity CVSS v4.0: Pending analysis
Last modification:
21/10/2024

CVE-2024-9985
Publication date:
15/10/2024
Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privileges can upload a webshell and use it to execute arbitrary code on the remote server.
Severity CVSS v4.0: Pending analysis
Last modification:
16/10/2024

CVE-2024-9984
Publication date:
15/10/2024
Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated remote attackers to use this functionality to obtain any user&amp;#39;s session cookie.
Severity CVSS v4.0: Pending analysis
Last modification:
16/10/2024
Subscribe to Vulnerabilities